--- a/sys/vfs/isofs/cd9660/cd9660_rrip.c
+++ b/sys/vfs/isofs/cd9660/cd9660_rrip.c
@@ -229,6 +229,17 @@
 	int wlen;
 	int cont;
 
+	/*
+	 * An NM entry needs at least the 4-byte SUSP header plus the flags
+	 * byte (name data starts at +5).  A shorter on-disk length makes
+	 * wlen negative; the u_short outlen accumulator then wraps and the
+	 * "treat as no name" rewind below moves the output pointer down by
+	 * a multiple of 64KB (out-of-bounds write at a wild address), or a
+	 * negative wlen reaches bcopy() as (size_t)-1.  Ignore such fields.
+	 */
+	if (isonum_711(p->h.length) < 5)
+		return (0);
+
 	inbuf = "..";
 	wlen = 0;
 	cont = 0;
--- a/sys/vfs/isofs/cd9660/cd9660_vnops.c
+++ b/sys/vfs/isofs/cd9660/cd9660_vnops.c
@@ -471,6 +471,7 @@
 	}
 	idp->eofflag = 1;
 	idp->curroff = uio->uio_offset;
+	idp->uio_off = uio->uio_offset;
 
 	if ((entryoffsetinblock = idp->curroff & bmask) &&
 	    (error = cd9660_devblkatoff(vdp, idp->curroff, NULL, &bp))) {